First IA64 Windows Virus Released 479
NinjaPablo writes "W64.RugRat.3344 has been released as a proof of concept virus. It is the first virus which will only run on Windows on the IA64 platform, and uses APIs from 3 native DLLs to avoid crashing applications. It infects files that are in the same folder as the virus and in all subfolders. The author of the virus has also written other concept virii in the past."
A toast... (Score:5, Funny)
somebody has to say it.. (Score:3, Funny)
so... (Score:5, Funny)
Re:so... (Score:2, Funny)
Re:so... (Score:3, Funny)
Or maybe would could execute the virus. Hmm, on the other hand that's not want we want to do
Critique of the virus (Score:4, Funny)
2) The virus does not run on 32-bit platform - so no chance of getting "Windows XP Compatible" logo.
3) The virus does not take advantage of the latest Longhorn, Avalon and Indigo features.
Overall, the work is impressive, but I am waiting for more robust and efficient viruses.
Re:Critique of the virus (Score:3, Interesting)
There's also
Re:Critique of the virus (Score:3, Interesting)
Re:Critique of the virus (Score:5, Funny)
To bad about the logo, but it can work on 32bits...
From the ArticleSo just get your 64 bit emulator running and you too can enjoy tomorrows viruses today!
I'mii soii gladii Iii runii Linuxii (Score:4, Funny)
Does that mean (Score:4, Funny)
Re:Does that mean (Score:2)
Re:Does that mean (Score:5, Funny)
Re:Does that mean (Score:2)
Re:Does that mean (Score:5, Funny)
So by RIAA math logic, this means that the virus writers are really causing $429,496,729,600,000,000 worth of damage!
Re:Does that mean (Score:5, Funny)
Re:Does that mean (Score:2, Informative)
???
Twice as fast?
(2^32)*2 = 2^64
Not really.
Re:Does that mean (Score:3, Informative)
And what moronic mods rated this Informative????
Re:Does that mean (Score:2)
Virii/Viruses (Score:5, Funny)
To try to stall everyone's almost certain flamewars regarding the correct plural form of virus, let me propose a new word.
Virusesii.
There, now everyone can use it, okay?
Re:Virii/Viruses (Score:5, Funny)
It's the second, not the first. (Score:5, Funny)
Doesn't this blow... (Score:5, Funny)
Re:Doesn't this blow... (Score:2, Interesting)
Re:Doesn't this blow... (Score:2)
Re:Doesn't this blow... (Score:2)
ahh young grasshopper... except for when you are asked to destroy that which you created.
ah, me (Score:5, Funny)
Yes! You're no longer limited to slowing your computer by simulating an architecture you don't have--you can run their viruses, too!
What are the legal implications? (Score:4, Interesting)
Could the DMCA be evoked in such a case?
Or is it only illegal when they are executed and allowed to spread to the wild?
Just some questions.
Feel free to respond, thanks.
Re:What are the legal implications? (Score:3, Insightful)
Seeing as this is Windows, it was less of a security measure and more of an invitation.
Re:What are the legal implications? (Score:2)
So what are the legal implications of writing viruses?
Legal implications? C'mon, this is the real world, not the mirror and smoke universe of regulators and lawyers.
It would be fun to see a virus/worm attacking the legal system itself. Kind of SCO. DDoSing courts, generating silly and contradictory jurisprudence and prompting for even more dumb laws and regulations until the judicial system comes to a grinding halt.
How would you reboot Justice then? Would we need a foreign power to invade us and pr
Re:What are the legal implications? (Score:5, Informative)
Umm... the DMCA doesn't really have anything to do with this; no copy-protection procedures have been circumvented, so no copyright violations have occurred here. In point of fact, the virus author hasn't broken any laws by writing and releasing this virus, assuming he hasn't been using it to damage any systems out there (besides his own).
Of course, if he actually were to try and damage someone's box with this virus he might have a hard time of it, since all it does is spread itself throughout the system... you get a minor to major slowdown and increase in file sizes, which can cause other things to break, but it's not very likely.
Wow, on the ball. Maybe MS should hire these guys. (Score:5, Funny)
Re:Wow, on the ball. Maybe MS should hire these gu (Score:3, Informative)
New Virus?!?! (Score:3, Funny)
In other news.... (Score:3, Funny)
According to spokesperson who didn't wish to be identified, he claimed that this had been the most infectious virus that he had seen in the twenty years of his career and had also proved to be worst to remove. He also recommended that all users should immediately buy the latest version of Anti-Virus-Sponge-Sentinel which would mop up all traces of the virus before it reached the system.
Re:In other news.... (Score:2, Funny)
Virii (Score:5, Funny)
Must not have had enough coffee when I submitted that...
Pendantic (Score:4, Funny)
A pendant is jewelry. You meant pedant, which is what I am being by responding. Like virii, your use of pendant is wrong. Not slang, just wrong.
If I referred to your sentence as "high-falutin'," that is slang. If I referred to it as "retartid," that is simply an incorrect spelling.
The English language isn't evolving new Latin-esque plurals. It's not slang. It's just ignorant pretension, which is the worst kind of pretension.
wow--oldskool (Score:5, Insightful)
Incidentally, you could probably limit your vulnerability if the program was installed by an Administrator but only run by users without write permission, or if you removed write permission from programs that you run in your own folders.
The really cool thing is that it's written in IA64 assembly code. That sounds like quite an impressive feat. From what I hear that is far worse even than the PPC64 assembly code I usually write.
PPC64 assembly (Score:2)
Re:wow--oldskool (Score:2)
This isn't a big deal (Score:3, Informative)
"The file infection routine is standard. The last section of the executable is marked as executable, the virus body is inserted into the
last section and a random number of bytes are appended to the end of the virus body."
What's the point? (Score:3, Funny)
Oh my god, I would never have thought that was possible! How can it be!? Mind boggling indeed! But it's great virus writers develop concept viruses to show us these amazing tasks that was previously thought impossible can actually be done!!
Where is the Open Source Virus? (Score:5, Funny)
Re:Where is the Open Source Virus? (Score:2)
Actually, a Python e-mail worm might not even be hard to code: batteries included + low linguistic security = evil, evil fun.
Re:Where is the Open Source Virus? (Score:5, Funny)
Gee, thanks! With friends like these... (Score:2)
Let me guess.... (Score:5, Funny)
Those 5 people must be pissed!! (Score:5, Funny)
This may be knit picking... (Score:5, Insightful)
From NTDLL.DLL the viruses uses the following 3 functions LdrGetDllHandle(), RtlAddVectoredExceptionHandler() and RtlRemoveVectoredExceptionHandler(). The virus supports vectored exception handling to avoid crashing during infections.
Yes, the virus uses three DLLs. It also uses a routine to avoid crashing itself while infecting the machine... it does not look like the virus cares about crashing other applications.
The thing to pay attention to here is that this is a fault tolerant virus. I have seen more and more effort lately (Sasser for example avoids shutdowns to help it propagate) from authors trying to make their creation survive.
Re:This may be knit picking... (Score:3, Funny)
[i]Nitpick[/i], the removal of lice eggs, came to mean detailed and precise criticism.
Not knit pick
IA64 = Itanium or AMD's x86-64? (Score:4, Insightful)
When palladium comes out and someone writes a virus that can escape it's sandbox, infect executables (which I'd imagine would involve resigning them) and spread, I'll be impressed.
so when will win64 be released? (Score:5, Funny)
someone must have mistyped (Score:3, Insightful)
someone must have mistyped that from this...
"Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if a certain browser's vulnerabilities are not patched.
*goes for the funny** (Score:3, Funny)
Does anyone know of a 64-bit version of Bochs or VirtualPC which ould let me run this new and interesting piece of code in emulation?
Flame Central (Score:4, Insightful)
Okay, just to collect all of the Microsoft trolls in one thread:
How can Windows ever be secure when exploits are released before the OS is available?!
It seems to me that Microsoft can't design a secure OS. After talking about security for more than 2 years, their latest incarnation is even less secure on its release date than Windows 95!
Microsoft: the Day Zero Exploit(tm) company
Re:A matter of perspective... (Score:3, Insightful)
I'm not going to attempt to refute all of your arguments (and perhaps I can't anyway), but I think your analysis lacks a bit of perspective as well.
For example, IBM's mainframes for most of their existence were not connected to anything outside of IBM so if there were buffer overruns etc, they could not be exploited. Even today, it's likely that most mainframes are no
Windows/IA64 (Score:2)
Proof of concept viruses not terrible (Score:5, Informative)
IANAVWOAVG, though (I Am Not A Virus Writer Or Anti-Virus Guy)
How is this a virus? (Score:3, Insightful)
From the article:
"The SfcIsFileProtected() function of SFC_OS.DLL is used to avoid infecting executables that are protected by SFC (the System File Checker)."
Any sensible XP64 installation would not allow system files to be write accessible to anyone but the Administrator.
It's as if I wrote a c program that used fopen() and write() to destroy files, then declared I wrote a virus for linux. Whoo hoo.
Re:Viruses, not virii! (Score:2, Funny)
Re:Viruses, not virii! (Score:2, Funny)
Re:There's no such word as "virii" (Score:5, Insightful)
*barf* (Score:4, Insightful)
Re:There's no such word as "virii" (Score:2, Funny)
Re:There's no such word as "virii" (Score:2, Insightful)
Re:There's no such word as "virii" (Score:3, Insightful)
Re:There's no such word as "virii" (Score:5, Insightful)
Re:There's no such word as "virii" (Score:3, Insightful)
What determines what is a word is NOT some definition of correctness. Useage is what defines the language. So if enough people were to use virii as the plural of virus it would be so.
This is pretty much a summation of the statement a language expert and senior editor of a well known, dictionary (who's name escapes me), said during an NPR interview a few months ago.
I'm shure if you looked ar
Re:Who's the retard? (Score:3, Insightful)
no dowt you can figur aut what this sentance is ment to meen two but that doesnt meen its not ridled with tyops. It's irritating to have to translate someone's text into English before I can read it (more accurately as I read it). If you want to communicate you should make every reasonable effort to achieve correctness of language. If you want to argue the descriptive-vs-prescriptive nature of dicti
the medium is the message (Score:2)
Re:There's no such word as "virii" (Score:2)
Re:There's no such word as "virii" (Score:5, Insightful)
It's called slang, and it's evolving and changing all the time. Were these people to use "virii" in an official capacity, such as in a company-wide memo, or an academic paper, there would be a problem. But this is Slashdot, for crying out loud. Get over yourself and have a little fun.
Re:There's no such word as "virii" (Score:3, Funny)
A nutjob might be radical to you and those who use the fake word 'virii'.
To those who use the word 'viruses', getting a nutjob is commonplace. Women really like a man who can speak English properly.
Re:There's no such word as "virii" (Score:5, Funny)
It is well known that the pluralizing of nouns in english is well defined:
ouse -> ice.
eg. house -> hice.
ata -> atabase.
eg. data -> database.
ink -> egnancy.
eg. drink -> pregnancy.
That one is a little tricky because it requires a change in the base word.
outer -> 0,000
cisco router -> $450,000
See previous example.
Just a thought.
Re:There's no such word as "virii" (Score:2)
Re:There's no such word as "virii" (Score:4, Funny)
Re:There's no such word as "virii" (Score:3, Funny)
Re:There's no such word as "virii" (Score:4, Informative)
Re:There's no such word as "virii" (Score:3, Insightful)
And whenever I see a
What about spending your time convincing people of more important issues like [insert anything else here]?
Re:There's no such word as "virii" (Score:3, Insightful)
Nope, you can't wipe out the word "virii". It just keeps spreading. As soon as one guy uses it around his two friends, it spreads to them. Then they each use the word around two other friends, who catch it. At this point it stops for a while, since those seven geeks don't have any other friends. But then one of them posts it online, and it spreads to hundreds of others.
Despite your efforts to stop it, the word "virii" will continue to
Re:Boxen (Score:5, Funny)
Re:Boxen (Score:4, Funny)
I am the walrus, we are the walrii
Re:Boxen (Score:4, Funny)
Re:Boxen (Score:5, Funny)
It's 'Boxi' -- second delclension plural as follows:
N: boxi
G: boxorum
D: boxis
Ac: boxum
Ab: boxis
Eunuch boxum Unix laudat.
("The eunuch praises Unix boxes.")
Something like that.
Re:Boxen (Score:2)
Now what if I laugh _and_ you get modded as a troll?
Re:W32/Shrug (Score:3, Interesting)
You -ing well don't know what -ing means. (Score:4, Funny)
Re:W32/Shrug (Score:4, Funny)
Re:W32/Shrug (Score:3, Funny)
Re:W32/Shrug (Score:4, Funny)
presumably trying to fight for Windows' security is also in vain.
Re:W32/Shrug (Score:2)
My favourite mnemonic was "Bad Boys Ravish* Our Young Girls But Violet Goes Willingly" (Black-blue-red, etc, colour bands on resistors). Rainbows always seemed dull after electronics class...
* Why, yes, this has been changed for our new PC times.
Re:W32/Shrug (Score:2)
roy g biv (Score:2)
Roy g biv is the author of the virus (Score:4, Informative)
29A is probably the most elite malware group out there.
Re:W32/Shrug (Score:2)
Re:W32/Shrug (Score:3, Funny)
Re:Conga Line (Score:2)
Re:Grr (Score:2, Funny)
At least that's why I think so many caught on with the term...
Re:Grr (Score:3, Funny)
Damn windows virius.